Attaching Videos

Deleted: Actual_TabCrash.ogv 2.4 MB

Actual_TabCrash.ogv 2.4 MB Download

Deleted: Expected_Tab.ogv 2.5 MB

Expected_Tab.ogv 2.5 MB Download

Issue is seen on Windows OS also

Adding the Label RB-Beta as this is a recent regression.

Manual good and Bad Builds:
Good Build: 52.0.2743.0
Bad Build:  53.0.2744.0

Below is the Tool Bisect Info:

CHANGELOG URL:
https://chromium.googlesource.com/chromium/src/+log/88b19ef7788c9b388cf5eb877d75c264d81e4298..ae1c373ff95da3c1386ddf89422036e29a396c95

Suspecting https://codereview.chromium.org/1994333002 from changelog

@jaydasika : Please feel free to re-assign if its not related to your change

Able to reproduce the issue on windows 7 using chrome version 53.0.2746.0.Not observed any crash on Mac OS.

stack trace of the report id
======================
Thread 2 CRASHED [SIGILL @ 0x00007f54e253eaf0 ] MAGIC SIGNATURE THREAD
0x00007f54e253eaf0	(chrome -./out/Release/../../cc/trees/property_tree.h:354 )	cc::LayerImpl::OnOpacityAnimated
0x00007f54e2531bfa	(chrome -./out/Release/../../cc/input/scrollbar_animation_controller_linear_fade.cc:58 )	cc::ScrollbarAnimationControllerLinearFade::ApplyOpacityToScrollbars
0x00007f54e25dda5b	(chrome -./out/Release/../../cc/trees/layer_tree_impl.cc:255 )	cc::LayerTreeImpl::UpdateScrollbars
0x00007f54e25da7bb	(chrome -./out/Release/../../cc/trees/layer_tree_host_impl.cc:3504 )	cc::LayerTreeHostImpl::RegisterScrollbarAnimationController
0x00007f54e26016eb	(chrome -./out/Release/../../cc/trees/tree_synchronizer.cc:134 )	cc::TreeSynchronizer::PushLayerProperties
0x00007f54e25d69c8	(chrome -./out/Release/../../cc/trees/layer_tree_host_impl.cc:1993 )	cc::LayerTreeHostImpl::ActivateSyncTree
0x00007f54e654d9e7	(chrome + 0x05abb9e7 )	_fini
0x00007f54e25f74fc	(chrome -./out/Release/../../cc/trees/proxy_impl.cc:583 )	cc::ProxyImpl::ScheduledActionActivateSyncTree
0x00007f54da5c392c	(libc-2.19.so -clock_gettime.c:115 )	__clock_gettime
0x00007f54e57649b2	(chrome -./out/Release/../../base/time/time_posix.cc:98 )	base::TimeTicks::Now
0x00007f54e654d9e7	(chrome + 0x05abb9e7 )	_fini
0x00007f54e25a3666	(chrome -./out/Release/../../cc/scheduler/scheduler.cc:689 )	cc::Scheduler::ProcessScheduledActions
0x00007f54e60c1b01	(chrome -./out/Release/../../third_party/tcmalloc/chromium/src/tcmalloc.cc:1045 )	tc_malloc
0x00007f54dab0acc0	(libstdc++.so.6.0.19 + 0x00074cc0 )	
0x00007f54e260790c	(chrome -./out/Release/../../build/linux/debian_wheezy_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/stl_tree.h:973 )	cc::RollingTimeDeltaHistory::InsertSample
0x00007f54e260a16f	(chrome + 0x01b7816f )	
0x00007f54e25f5f25	(chrome -./out/Release/../../cc/trees/proxy_impl.cc:343 )	cc::ProxyImpl::NotifyReadyToActivate
0x00007f54e25b99ce	(chrome -./out/Release/../../cc/tiles/tile_manager.cc:419 )	cc::TileManager::DidFinishRunningTileTasksRequiredForActivation
0x00007f54e260a16f	(chrome + 0x01b7816f )	
0x00007f54e25b904d	(chrome -./out/Release/../../cc/tiles/tile_manager.cc:1049 )	cc::TileManager::CheckAndIssueSignals
0x00007f54da5c392c	(libc-2.19.so -clock_gettime.c:115 )	__clock_gettime

Issue is also reproducible when :
1)Go to any Page (Ex:chrome://Apps)
2)Now Press F12 to open Dev tools->Click on "Toggle device toolbar" -> Now disable it -> Again click on "Toggle device toolbar"  and observe Crash(Please refer Video)

Deleted: Actual_Crash.ogv 1.6 MB

Actual_Crash.ogv 1.6 MB Download

Issue 613897 has been merged into this issue.

Issue 613886 has been merged into this issue.

Users experienced this crash on the following builds:

Win Canary 53.0.2746.0 -  60.69 CPM, 406 reports, 154 clients (signature cc::LayerImpl::UpdatePropertyTreeOpacity)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Users experienced this crash on the following builds:

Win Canary 53.0.2746.0 -  3.29 CPM, 22 reports, 11 clients (signature cc::PropertyTree<cc::TreeNode<cc::EffectNodeData> >::Node)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Users experienced this crash on the following builds:

Win Canary 53.0.2746.0 -  60.69 CPM, 406 reports, 154 clients (signature cc::LayerImpl::UpdatePropertyTreeOpacity)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Users experienced this crash on the following builds:

Win Canary 53.0.2746.0 -  3.29 CPM, 22 reports, 11 clients (signature cc::PropertyTree<cc::TreeNode<cc::EffectNodeData> >::Node)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

I think something is concurrently modifying cc::LayerImpl::effect_tree_index_.

I was able to attach to a about-to-crash renderer, and index passed to PropertyTree::Node() is 6 (but number of elements is 5). However, if I go up to cc::LayerImpl::UpdatePropertyTreeOpacity() and check value of effect_tree_index_, it's 1:


#2  0xddea38c4 in cc::PropertyTree<cc::TreeNode<cc::EffectNodeData> >::Node (this=0xef64fcb4, this@entry=0xef64fd68, i=6)
    at ../../cc/trees/property_tree.h:357
(gdb) p i
$12 = 6
(gdb) p *this
$19 = {
  nodes_ = {
    <std::__1::__vector_base<cc::TreeNode<cc::EffectNodeData>, std::__1::allocator<cc::TreeNode<cc::EffectNodeData> > >> = {
      <std::__1::__vector_base_common<true>> = {<No data fields>}, 
      members of std::__1::__vector_base<cc::TreeNode<cc::EffectNodeData>, std::__1::allocator<cc::TreeNode<cc::EffectNodeData> > >: 
      __begin_ = 0xb7762780, 
      __end_ = 0xb77628ac, 
      __end_cap_ = {
        <std::__1::__libcpp_compressed_pair_imp<cc::TreeNode<cc::EffectNodeData>*, std::__1::allocator<cc::TreeNode<cc::EffectNodeData> >, 2u>> = {
          <std::__1::allocator<cc::TreeNode<cc::EffectNodeData> >> = {<No data fields>}, 
          members of std::__1::__libcpp_compressed_pair_imp<cc::TreeNode<cc::EffectNodeData>*, std::__1::allocator<cc::TreeNode<cc::EffectNodeData> >, 2u>: 
          __first_ = 0xb77628ac
        }, <No data fields>}
    }, <No data fields>}, 
  needs_update_ = false, 
  property_trees_ = 0xef64fc1c
}
(gdb) p (0xb77628ac - 0xb7762780) / sizeof(cc::TreeNode<cc::EffectNodeData>)
$20 = 5


#4  cc::LayerImpl::UpdatePropertyTreeOpacity (this=0xba6fb124, this@entry=0xdbbc5000) at ../../cc/layers/layer_impl.cc:711
711	    EffectNode* node = property_trees->effect_tree.Node(effect_tree_index_);
(gdb) p effect_tree_index_
$24 = 1
(gdb) p *this
$25 = {
  _vptr.LayerImpl = 0x2, 
  parent_ = 0xe081828c <vtable for std::__1::basic_ostringstream<char, std::__1::char_traits<char>, std::__1::allocator<char> >+12>, 
  children_ = {
    <std::__1::__vector_base<cc::LayerImpl*, std::__1::allocator<cc::LayerImpl*> >> = {
      <std::__1::__vector_base_common<true>> = {<No data fields>}, 
      members of std::__1::__vector_base<cc::LayerImpl*, std::__1::allocator<cc::LayerImpl*> >: 
      __begin_ = 0xe08181b8 <vtable for std::__1::basic_streambuf<char, std::__1::char_traits<char> >+8>, 
      __end_ = 0xe096d648 <std::__1::locale::__imp& std::__1::(anonymous namespace)::make<std::__1::locale::__imp, unsigned int>(unsigned int)::buf>, 
      __end_cap_ = {
        <std::__1::__libcpp_compressed_pair_imp<cc::LayerImpl**, std::__1::allocator<cc::LayerImpl*>, 2u>> = {
          <std::__1::allocator<cc::LayerImpl*>> = {<No data fields>}, 
          members of std::__1::__libcpp_compressed_pair_imp<cc::LayerImpl**, std::__1::allocator<cc::LayerImpl*>, 2u>: 
          __first_ = 0x0
        }, <No data fields>}
    }, <No data fields>}, 
  mask_layer_id_ = 0, 
  mask_layer_ = 0x0, 
  replica_layer_id_ = -1208223296, 
  replica_layer_ = 0xb7fbf9ee, 
  layer_id_ = -1208223233, 
  layer_tree_impl_ = 0x41, 
  test_properties_ = {
    __ptr_ = {
      <std::__1::__libcpp_compressed_pair_imp<cc::LayerImplTestProperties*, std::__1::default_delete<cc::LayerImplTestProperties>, 2u>> = {
        <std::__1::default_delete<cc::LayerImplTestProperties>> = {<No data fields>}, 
        members of std::__1::__libcpp_compressed_pair_imp<cc::LayerImplTestProperties*, std::__1::default_delete<cc::LayerImplTestProperties>, 2u>: 
        __first_ = 0x3f
      }, <No data fields>}
  }, 
  bounds_delta_ = {
    x_ = -3.00378306e-05, 
    y_ = -3.00379143e-05
  }, 
  bounds_ = 16x-527355852, 
  scroll_clip_layer_id_ = 4098, 
  offset_to_transform_parent_ = {
    x_ = 8.40779079e-45, 
    y_ = 0
  }, 
  main_thread_scrolling_reasons_ = 0, 
  user_scrollable_horizontal_ = false, 
  user_scrollable_vertical_ = false, 
  should_flatten_transform_from_property_tree_ = false, 
  layer_property_changed_ = false, 
  masks_to_bounds_ = false, 
  contents_opaque_ = false, 
  use_parent_backface_visibility_ = false, 
  use_local_transform_for_backface_visibility_ = false, 
  should_check_backface_visibility_ = false, 
  draws_content_ = false, 
  is_drawn_render_surface_layer_list_member_ = false, 
  is_affected_by_page_scale_ = false, 
  was_ever_ready_since_last_transform_animation_ = false, 
  non_fast_scrollable_region_ = {
    skregion_ = {
      static kOpCnt = 6, 
      fBounds = {
        fLeft = -1167085268, 
        fTop = -526985656, 
        fRight = 0, 
        fBottom = 0
      }, 
      fRunHead = 0x0
    }
  }, 
  touch_event_handler_region_ = {
    skregion_ = {
      static kOpCnt = 6, 
      fBounds = {
        fLeft = 0, 
        fTop = 0, 
        fRight = 0, 
        fBottom = 0
      }, 
      fRunHead = 0x0
    }
  }, 
  background_color_ = 0, 
  safe_opaque_background_color_ = 0, 
  opacity_ = 0, 
  blend_mode_ = 32, 
  draw_blend_mode_ = 29, 
  position_ = -5.1338608e+19,4.97460955e-43, 
  transform_ = {
    matrix_ = {
      fMat = {{-1.91581858e-05, -0.000914362492, -7.86214036e+17, -1.06010513e+17}, {-0.000914364588, -0.000914363889, -7.86199467e+17, 1}, {
          0, 1.40129846e-45, -1.46114689e-05, -0.000914366683}, {-7.86182975e+17, -9.49878013e-05, -1.46114689e-05, -9.499304e-05}}, 
      fTypeMask = 2
    }
  }, 
  clip_rect_in_target_space_ = 1142358016,0 1x-1194904528, 
  transform_tree_index_ = -1167084888, 
  effect_tree_index_ = 1, 
  clip_tree_index_ = -1167084828, 
  scroll_tree_index_ = -587855876, 
  filters_ = {
    operations_ = {
      <std::__1::__vector_base<cc::FilterOperation, std::__1::allocator<cc::FilterOperation> >> = {
        <std::__1::__vector_base_common<true>> = {<No data fields>}, 
        members of std::__1::__vector_base<cc::FilterOperation, std::__1::allocator<cc::FilterOperation> >: 
        __begin_ = 0x2, 
        __end_ = 0xdcfe4dcc <base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&)+196>, 
        __end_cap_ = {
          <std::__1::__libcpp_compressed_pair_imp<cc::FilterOperation*, std::__1::allocator<cc::FilterOperation>, 2u>> = {
            <std::__1::allocator<cc::FilterOperation>> = {<No data fields>}, 
            members of std::__1::__libcpp_compressed_pair_imp<cc::FilterOperation*, std::__1::allocator<cc::FilterOperation>, 2u>: 
            __first_ = 0x2
          }, <No data fields>}
      }, <No data fields>}
  }, 
  background_filters_ = {
    operations_ = {
      <std::__1::__vector_base<cc::FilterOperation, std::__1::allocator<cc::FilterOperation> >> = {
        <std::__1::__vector_base_common<true>> = {<No data fields>}, 
        members of std::__1::__vector_base<cc::FilterOperation, std::__1::allocator<cc::FilterOperation> >: 
        __begin_ = 0xdcfe4e94 <base::MessageLoop::RunTask(base::PendingTask const&)+160>, 
        __end_ = 0x2, 
        __end_cap_ = {
          <std::__1::__libcpp_compressed_pair_imp<cc::FilterOperation*, std::__1::allocator<cc::FilterOperation>, 2u>> = {
            <std::__1::allocator<cc::FilterOperation>> = {<No data fields>}, 
            members of std::__1::__libcpp_compressed_pair_imp<cc::FilterOperation*, std::__1::allocator<cc::FilterOperation>, 2u>: 
            __first_ = 0xdcfe5184 <base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&)+172>
          }, <No data fields>}
      }, <No data fields>}
  }, 
  sorting_context_id_ = 2, 
  current_draw_mode_ = 3706745292, 
  element_id_ = 12297160564, 
  mutable_properties_ = 3710810704, 
  update_rect_ = 2,-588244496 -278594560x-278223232, 
  damage_rect_ = -1167084888,-278215120 -1167084884x18, 
  copy_requests_ = {
    <std::__1::__vector_base<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> >, std::__1::allocator<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> > > >> = {
      <std::__1::__vector_base_common<true>> = {<No data fields>}, 
      members of std::__1::__vector_base<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> >, std::__1::allocator<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> > > >: 
      __begin_ = 0x2, 
      __end_ = 0xdd2e8054 <cc::PictureLayerImpl::PushPropertiesTo(cc::LayerImpl*)+208>, 
      __end_cap_ = {
        <std::__1::__libcpp_compressed_pair_imp<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> >*, std::__1::allocator<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> > >, 2u>> = {
          <std::__1::allocator<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> > >> = {<No data fields>}, 
          members of std::__1::__libcpp_compressed_pair_imp<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> >*, std::__1::allocator<std::__1::unique_ptr<cc::CopyOutputRequest, std::__1::default_delete<cc::CopyOutputRequest> > >, 2u>: 
          __first_ = 0x2
        }, <No data fields>}
    }, <No data fields>}, 
  draw_properties_ = {
    target_space_transform = {
      matrix_ = {
        fMat = {{-5.5356892e+17, 412, 604, 412}, {3457, 0, 0, 0}, {0, 0, 0, -9.499304e-05}, {-9.49878013e-05, 2.80259693e-45, 0, 
            1.35925951e-43}}, 
        fTypeMask = 0
      }
    }, 
    screen_space_transform = {
      matrix_ = {
        fMat = {{0, -7.08672315e+28, 8.40779079e-45, 2.52233724e-44}, {-0.000914386706, -6.25087184e+28, -6.28390574e+28, 0}, {
            -0.000914380187, -5.53815211e+17, 1.35925951e-43, 2.52233724e-44}, {1.35925951e-43, -7.26207784e+28, -1.06033603e+17, 
            -7.08672315e+28}}, 
        fTypeMask = 3127882516
      }
    }, 
    occlusion_in_content_space = {
      draw_transform_ = {
        matrix_ = {
          fMat = {{-5.53987559e+17, -7.26207784e+28, -7.26207784e+28, -0.000914383912}, {-7.85890779e+17, -0.000914386706, -6.25087184e+28, 
              -6.28390574e+28}, {0, -0.000914383912, -1.06033603e+17, -7.26207784e+28}, {-7.08672315e+28, -0.000914386706, -6.25087184e+28, 
              -0.000914385775}}, 
          fTypeMask = 3710812060
        }
      }, 
      occlusion_from_outside_target_ = {
        rect_ = -1216888064,-608413056 -278594560x-1216888064
      }, 
      occlusion_from_inside_target_ = {
        rect_ = -608413056,-278594560 -1167084636x-571375304
      }
    }, 
    opacity = -0.0009143895, 
    screen_space_transform_is_animating = false, 
    can_use_lcd_text = false, 
    is_clipped = false, 
    visible_layer_rect = 0,-1216886768 1x-1178100480, 
    drawable_content_rect = 97,-1216886768 49x1065353216, 
    clip_rect = -278229504,-278593024 -1167084568x-527009679, 
    maximum_animation_contents_scale = -0.00091439602, 
    starting_animation_contents_scale = -5.5582017e+17
  }, 
  performance_properties_ = {
    num_fixed_point_hits = 1, 
    translation_from_last_frame = -4.64232979e+31, 
    last_commit_screen_space_transform = {
      matrix_ = {
        fMat = {{2.80259693e-45, -3.43854341e+33, 2.80259693e-45, -5.71808719e+17}, {2.80259693e-45, -5.71827273e+17, 2.80259693e-45, 
            -5.72589097e+17}, {2.80259693e-45, -5.72593907e+17, 2.80259693e-45, -5.72610125e+17}, {2.80259693e-45, -5.72624006e+17, 
            2.80259693e-45, -5.72641461e+17}}, 
        fTypeMask = 2
      }
    }
  }, 
  owned_debug_info_ = {
    __ptr_ = {
      <std::__1::__libcpp_compressed_pair_imp<base::trace_event::ConvertableToTraceFormat*, std::__1::default_delete<base::trace_event::ConvertableToTraceFormat>, 2u>> = {
        <std::__1::default_delete<base::trace_event::ConvertableToTraceFormat>> = {<No data fields>}, 
        members of std::__1::__libcpp_compressed_pair_imp<base::trace_event::ConvertableToTraceFormat*, std::__1::default_delete<base::trace_event::ConvertableToTraceFormat>, 2u>: 
        __first_ = 0x0
      }, <No data fields>}
  }, 
  debug_info_ = 0x3, 
  render_surface_ = {
    __ptr_ = {
      <std::__1::__libcpp_compressed_pair_imp<cc::RenderSurfaceImpl*, std::__1::default_delete<cc::RenderSurfaceImpl>, 2u>> = {
        <std::__1::default_delete<cc::RenderSurfaceImpl>> = {<No data fields>}, 
        members of std::__1::__libcpp_compressed_pair_imp<cc::RenderSurfaceImpl*, std::__1::default_delete<cc::RenderSurfaceImpl>, 2u>: 
        __first_ = 0xe0967871 <base::trace_event::(anonymous namespace)::g_category_group_enabled+25>
      }, <No data fields>}
  }, 
  scrolls_drawn_descendant_ = 56, 
  has_will_change_transform_hint_ = 31
}

dskiba: Thanks for the analysis. https://codereview.chromium.org/1994333002/ added a map and changed cc::LayerImpl::UpdatePropertyTreeOpacity() to use it instead of effect_tree_index_. The value in the map should match effect_tree_index_ (there is a DCHECK for this right before the line of crash) but it seems like it doesn't match in this case and hence the crash. A revert of that CL is already in CQ (https://codereview.chromium.org/2004973002/).

Hmm, so previously LayerImpl::UpdatePropertyTreeOpacity() explicitly checked effect_tree_index_ to be valid before proceeding:

-    if (effect_tree_index_ >= static_cast<int>(effect_tree.size()))
-      return;

your change removed that, and mismatch between effect_tree_index_ and effect_tree.size() started triggering CHECK() in PropertyTree::Node().

So I think the problem is still there, it's just less obvious without your change.

dskiba : You are right. We somehow end up with the wrong effect tree index, I will look into it.

https://codereview.chromium.org/2004973002 reverts the culprit CL.

Issue 614203 has been merged into this issue.

FWIW I was getting this crash (I think?) all weekend on Android Chrome 53.0.2746.0, I would say at least a few crashes an hour because I kept forgetting that searching for anything on Google would crash Chrome.

I never got any crashes in chrome://crashes. Looking in logcat I got this:

F/libc    (11023): Fatal signal 5 (SIGTRAP), code 1 in tid 11049 (Compositor)
05-27 07:33:00.629 F/DEBUG   ( 4280): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
05-27 07:33:00.629 F/DEBUG   ( 4280): Build fingerprint: 'google/angler/angler:6.0.1/MTC19T/2741993:user/release-keys'
05-27 07:33:00.629 F/DEBUG   ( 4280): Revision: '0'
05-27 07:33:00.629 F/DEBUG   ( 4280): ABI: 'arm64'
05-27 07:33:00.630 F/DEBUG   ( 4280): pid: 11023, tid: 11049, name: Compositor  >>> com.chrome.canary:sandboxed_process5 <<<
05-27 07:33:00.630 F/DEBUG   ( 4280): signal 5 (SIGTRAP), code 1 (TRAP_BRKPT), fault addr 0x182c700002b0f
05-27 07:33:00.653 F/DEBUG   ( 4280):     x0   0000000000000024  x1   0000000000000004  x2   0000000000000004  x3   0000000000000120
05-27 07:33:00.653 F/DEBUG   ( 4280):     x4   0000007f77bbae00  x5   0000000000000004  x6   0000000000000002  x7   0000000000000004
05-27 07:33:00.653 F/DEBUG   ( 4280):     x8   0000000000000000  x9   0000007f793ff4f0  x10  0000000000000001  x11  0000007f89a21c60
05-27 07:33:00.654 F/DEBUG   ( 4280):     x12  0000007f92e45b40  x13  0000000000000007  x14  0000000000000008  x15  000000000000008c
05-27 07:33:00.654 F/DEBUG   ( 4280):     x16  000000000000008d  x17  0000007f92e45000  x18  0000007f89a21c60  x19  0000007f8fb56780
05-27 07:33:00.654 F/DEBUG   ( 4280):     x20  0000007f8e2e9d00  x21  0000007f8e2e9d30  x22  0000007f793fe8f8  x23  0000007f8e2e9d00
05-27 07:33:00.654 F/DEBUG   ( 4280):     x24  0000007f79677000  x25  0000000000000000  x26  0000007f793fea30  x27  0000007f793fea30
05-27 07:33:00.654 F/DEBUG   ( 4280):     x28  0000007f8fb56780  x29  0000007f793fe850  x30  0000007f6e951864
05-27 07:33:00.654 F/DEBUG   ( 4280):     sp   0000007f793fe850  pc   0000007f6e9518e0  pstate 0000000060000000
05-27 07:33:00.656 F/DEBUG   ( 4280):
05-27 07:33:00.656 F/DEBUG   ( 4280): backtrace:
05-27 07:33:00.657 F/DEBUG   ( 4280):     #00 pc 0000000000cd08e0  /data/app/com.chrome.canary-2/base.apk (offset 0xbe8000)
05-27 07:33:00.657 F/DEBUG   ( 4280):     #01 pc 0000000000cd0860  /data/app/com.chrome.canary-2/base.apk (offset 0xbe8000)
05-27 07:33:00.815 W/debuggerd64( 4280): type=1400 audit(0.0:8025): avc: denied { search } for name="com.chrome.canary" dev="dm-2" ino=1696314 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
05-27 07:33:00.859 F/DEBUG   ( 4280):
05-27 07:33:00.859 F/DEBUG   ( 4280): Tombstone written to: /data/tombstones/tombstone_03
05-27 07:33:00.859 E/DEBUG   ( 4280): AM write failed: Broken pipe

with no microdump ever produced. Perhaps there is something up with the crash reporting?

Issue 614053 has been merged into this issue.

Re #23 : If its in 53.0.2746.0, I don't think its the same crash. I can verify if you can tell me how to repro it.

re: #25. repro steps for the crash I am seeing are very easy:

1. Install Chrome Canary Android version 53.0.2746.0 (this is the current version).
2. perform a search from the URL bar, or visit a large number of websites e.g. m.imgur.com and click on image.
3. Chrome Crashes.

Should I raise a new bug for this then?

Re #26 : I am unable to repro the crash. In any case, unless you see a crash stack similar to #4, I think you should raise a new bug.  

Seems this can be closed.